FedRAMP Moderate Revision 4

fedramp_moderate_revision_4_aws

FedRamp-Moderate-Revision-4

OfficialVerified

The Federal Risk and Authorization Management Program (FedRAMP) was established in 2011. It provides a cost-effective, risk-based approach for the adoption and use of cloud services by the U.S. federal government. FedRAMP empowers federal agencies to use modern cloud technologies, with an emphasis on the security and protection of federal information.

63requirements96checks

Prowler prowler-provider-aws

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance fedramp_moderate_revision_4_aws

Requirements (63)

Access Control (AC)15187

ac-2-1The organization employs automated mechanisms to support the management of information system accounts.17

Attributes

Item Id: ac-2-1
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac-2-4The information system automatically audits account creation, modification, enabling, disabling, and removal actions, and notifies [Assignment: organization-defined personnel or roles].13

Attributes

Item Id: ac-2-4
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac-2-12-aThe organization: a. Monitors information system accounts for [Assignment: organization-defined atypical use].2

Attributes

Item Id: ac-2-12-a
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac-2-fThe organization: f. Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions].15

Attributes

Item Id: ac-2-f
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac-2-gThe organization: g. Monitors the use of information system accounts.11

Attributes

Item Id: ac-2-g
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac-2-jThe organization: j. Reviews accounts for compliance with account management requirements [Assignment: organization-defined frequency].14

Attributes

Item Id: ac-2-j
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac-2-3The information system automatically disables inactive accounts after 90 days for user accounts.6

Attributes

Item Id: ac-2-3
Section: Access Control (AC)
Service: aws
Sub Section: Account Management (AC-2)

ac-3The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.22

Attributes

Item Id: ac-3
Section: Access Control (AC)
Service: aws

ac-4The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on organization-defined information flow control policies.16

Attributes

Item Id: ac-4
Section: Access Control (AC)
Service: aws

ac-5-cThe organization: c. Defines information system access authorizations to support separation of duties.8

Attributes

Item Id: ac-5-c
Section: Access Control (AC)
Service: aws
Sub Section: Separation Of Duties (AC-5)

ac-6-10The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.4

Attributes

Item Id: ac-6-10
Section: Access Control (AC)
Service: aws
Sub Section: Least Privilege (AC-6)

ac-6The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.26

Attributes

Item Id: ac-6
Section: Access Control (AC)
Service: aws

ac-17-1The information system monitors and controls remote access methods.17

Attributes

Item Id: ac-17-1
Section: Access Control (AC)
Service: aws
Sub Section: Remote Access (AC-17)

ac-17-2The information system implements cryptographic mechanisms to protect the confidentiality and integrity of remote access sessions.3

Attributes

Item Id: ac-17-2
Section: Access Control (AC)
Service: aws
Sub Section: Remote Access (AC-17)

ac-21-bThe organization: b. Employs [Assignment: organization-defined automated mechanisms or manual processes] to assist users in making information sharing/collaboration decisions.13

Attributes

Item Id: ac-21-b
Section: Access Control (AC)
Service: aws
Sub Section: Information Sharing (AC-21)

Audit and Accountability (AU)863

au-2-a-dThe organization: a. Determines that the information system is capable of auditing the following events: Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. For Web applications: all administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes. d. Determines that the following events are to be audited within the information system: [organization-defined subset of the auditable events defined in AU-2 a to be audited continually for each identified event].12

Attributes

Item Id: au-2-a-d
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Events (AU-2)

au-3The information system generates audit records containing information that establishes what type of event occurred, when the event occurred, where the event occurred, the source of the event, the outcome of the event, and the identity of any individuals or subjects associated with the event.11

Attributes

Item Id: au-3
Section: Audit and Accountability (AU)
Service: aws

au-6-1-3(1) The organization employs automated mechanisms to integrate audit review, analysis, and reporting processes to support organizational processes for investigation and response to suspicious activities. (3) The organization analyzes and correlates audit records across different repositories to gain organization-wide situational awareness.18

Attributes

Item Id: au-6-1-3
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Review, Analysis And Reporting (AU-6)

au-7-1The information system provides the capability to process audit records for events of interest based on [Assignment: organization-defined audit fields within audit records].5

Attributes

Item Id: au-7-1
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Reduction And Report Generation (AU-7)

au-9-2The information system backs up audit records at least weekly onto a physically different system or system component than the system or component being audited.1

Attributes

Item Id: au-9-2
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Protection of Audit Information (AU-9)

au-9The information system protects audit information and audit tools from unauthorized access, modification, and deletion.3

Attributes

Item Id: au-9
Section: Audit and Accountability (AU)
Service: aws

au-11The organization retains audit records for at least 90 days to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.1

Attributes

Item Id: au-11
Section: Audit and Accountability (AU)
Service: aws

au-12-a-cThe information system: a. Provides audit record generation capability for the auditable events defined in AU-2 a. at all information system and network components where audit capability is deployed/available c. Generates audit records for the events defined in AU-2 d. with the content defined in AU-3.12

Attributes

Item Id: au-12-a-c
Section: Audit and Accountability (AU)
Service: aws
Sub Section: Audit Generation (AU-12)

Security Assessment And Authorization (CA)113

ca-7-a-bThe organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a. Establishment of [Assignment: organization-defined metrics] to be monitored; b. Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring.13

Attributes

Item Id: ca-7-a-b
Section: Security Assessment And Authorization (CA)
Service: aws
Sub Section: Continuous Monitoring (CA-7)

Configuration Management (CM)428

cm-2The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.20

Attributes

Item Id: cm-2
Section: Configuration Management (CM)
Service: aws

cm-7-aThe organization: a. Configures the information system to provide only essential capabilities.3

Attributes

Item Id: cm-7-a
Section: Configuration Management (CM)
Service: aws
Sub Section: Least Functionality (CM-7)

cm-8-1The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.2

Attributes

Item Id: cm-8-1
Section: Configuration Management (CM)
Service: aws
Sub Section: Information System Component Inventory (CM-8)

cm-8-3-aThe organization: a. Employs automated mechanisms continuously, using automated mechanisms with a maximum five-minute delay in detection, to detect the presence of unauthorized hardware, software, and firmware components within the information system3

Attributes

Item Id: cm-8-3-a
Section: Configuration Management (CM)
Service: aws
Sub Section: Information System Component Inventory (CM-8)

Contingency Planning (CP)212

cp-9-bThe organization: b. Conducts backups of system-level information contained in the information system (daily incremental; weekly full).5

Attributes

Item Id: cp-9-b
Section: Contingency Planning (CP)
Service: aws
Sub Section: Information System Backup (CP-9)

cp-10The organization provides for the recovery and reconstitution of the information system to a known state after a disruption, compromise, or failure.7

Attributes

Item Id: cp-10
Section: Contingency Planning (CP)
Service: aws

Identification and Authentication (IA)610

ia-2-1-2(1) The information system implements multifactor authentication for network access to privileged accounts. (2) The information system implements multifactor authentication for network access to non- privileged accounts.3

Attributes

Item Id: ia-2-1-2
Section: Identification and Authentication (IA)
Service: iam
Sub Section: IA-2(1) Network Access To Privileged Accounts

ia-2-1The information system implements multi-factor authentication for network access to privileged accounts.3

Attributes

Item Id: ia-2-1
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Identification and Authentication (Organizational users) (IA-2)

ia-2The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).2

Attributes

Item Id: ia-2
Section: Identification and Authentication (IA)
Service: iam

ia-5-1-a-d-eThe information system, for password-based authentication: a. Enforces minimum password complexity of [Assignment: organization-defined requirements for case sensitivity, number of characters, mix of upper-case letters, lower-case letters, numbers, and special characters, including minimum requirements for each type]; d. Enforces password minimum and maximum lifetime restrictions of [Assignment: organization- defined numbers for lifetime minimum, lifetime maximum]; e. Prohibits password reuse for 24 generations1

Attributes

Item Id: ia-5-1-a-d-e
Section: Identification and Authentication (IA)
Service: iam
Sub Section: IA-5(1) Password-Based Authentication

ia-5-4The organization employs automated tools to determine if password authenticators are sufficiently strong to satisfy [Assignment: organization-defined requirements].1

Attributes

Item Id: ia-5-4
Section: Identification and Authentication (IA)
Service: iam
Sub Section: Authenticator Management (IA-5)

ia-5-7The organization ensures that unencrypted static authenticators are not embedded in applications or access scripts or stored on function keys.0

Attributes

Item Id: ia-5-7
Section: Identification and Authentication (IA)
Service: codebuild
Sub Section: Authenticator Management (IA-5)

Incident Response (IR)313

ir-4-1The organization employs automated mechanisms to support the incident handling process.7

Attributes

Item Id: ir-4-1
Section: Incident Response (IR)
Service: aws
Sub Section: Incident Handling (IR-4)

ir-6-1The organization employs automated mechanisms to assist in the reporting of security incidents.3

Attributes

Item Id: ir-6-1
Section: Incident Response (IR)
Service: aws
Sub Section: Incident Reporting (IR-6)

ir-7-1The organization employs automated mechanisms to increase the availability of incident response-related information and support.3

Attributes

Item Id: ir-7-1
Section: Incident Response (IR)
Service: aws
Sub Section: Incident Response Assistance (IR-7)

Risk Assessment (RA)12

ra-5Scan for system vulnerabilities. Share vulnerability information and security controls that eliminate vulnerabilities.2

Attributes

Item Id: ra-5
Section: Risk Assessment (RA)
Service: guarduty

System and Services Acquisition (SA)25

sa-3-aThe organization: a. Manages the information system using [Assignment: organization-defined system development life cycle] that incorporates information security considerations.1

Attributes

Item Id: sa-3-a
Section: System and Services Acquisition (SA)
Service: aws
Sub Section: System Development Life Cycle (SA-3)

sa-10The organization requires the developer of the information system, system component, or information system service to: a. Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation]; b. Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management]; c. Implement only organization-approved changes to the system, component, or service; d. Document approved changes to the system, component, or service and the potential security impacts of such changes; and e. Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].4

Attributes

Item Id: sa-10
Section: System and Services Acquisition (SA)
Service: aws

System and Communications Protection (SC)1198

sc-2The information system separates user functionality (including user interface services) from information system management functionality.4

Attributes

Item Id: sc-2
Section: System and Communications Protection (SC)
Service: iam

sc-4The information system prevents unauthorized and unintended information transfer via shared system resources.12

Attributes

Item Id: sc-4
Section: System and Communications Protection (SC)
Service: aws

sc-5The information system protects against or limits the effects of the following types of denial of service attacks: [Assignment: organization-defined types of denial of service attacks or references to sources for such information] by employing [Assignment: organization-defined security safeguards].6

Attributes

Item Id: sc-5
Section: System and Communications Protection (SC)
Service: aws

sc-7-3The organization limits the number of external network connections to the information system.16

Attributes

Item Id: sc-7-3
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Boundary Protection (SC-7)

sc-7The information system: a. Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; b. Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and c. Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.20

Attributes

Item Id: sc-7
Section: System and Communications Protection (SC)
Service: aws

sc-8-1The information system implements cryptographic mechanisms to [Selection (one or more): prevent unauthorized disclosure of information; detect changes to information] during transmission unless otherwise protected by [Assignment: organization-defined alternative physical safeguards].9

Attributes

Item Id: sc-8-1
Section: System and Communications Protection (SC)
Service: aws
Sub Section: Transmission Integrity (SC-8)

sc-8The information system protects the confidentiality AND integrity of transmitted information.9

Attributes

Item Id: sc-8
Section: System and Communications Protection (SC)
Service: aws

sc-12The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with [Assignment: organization-defined requirements for key generation, distribution, storage, access, and destruction].4

Attributes

Item Id: sc-12
Section: System and Communications Protection (SC)
Service: aws

sc-13The information system implements FIPS-validated or NSA-approved cryptography in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.3

Attributes

Item Id: sc-13
Section: System and Communications Protection (SC)
Service: aws

sc-23The information system protects the authenticity of communications sessions.4

Attributes

Item Id: sc-23
Section: System and Communications Protection (SC)
Service: aws

sc-28The information system protects the confidentiality AND integrity of [Assignment: organization-defined information at rest].11

Attributes

Item Id: sc-28
Section: System and Communications Protection (SC)
Service: aws

System and Information Integrity (SI)1066

si-2-2The organization employs automated mechanisms at least monthly to determine the state of information system components with regard to flaw remediation.2

Attributes

Item Id: si-2-2
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Flaw Remediation (SI-2)

si-4-1The organization connects and configures individual intrusion detection tools into an information system-wide intrusion detection system.1

Attributes

Item Id: si-4-1
Section: System and Information Integrity (SI)
Service: guarduty
Sub Section: Information System Monitoring (SI-4)

si-4-16The organization correlates information from monitoring tools employed throughout the information system.6

Attributes

Item Id: si-4-16
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Information System Monitoring (SI-4)

si-4-2The organization employs automated tools to support near real-time analysis of events.13

Attributes

Item Id: si-4-2
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Information System Monitoring (SI-4)

si-4-4The information system monitors inbound and outbound communications traffic continuously for unusual or unauthorized activities or conditions.11

Attributes

Item Id: si-4-4
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Information System Monitoring (SI-4)

si-4-5The information system alerts organization-defined personnel or roles when the following indications of compromise or potential compromise occur: [Assignment: organization-defined compromise indicators].11

Attributes

Item Id: si-4-5
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Information System Monitoring (SI-4)

si-4-a-b-cThe organization: a. Monitors the information system to detect: 1. Attacks and indicators of potential attacks in accordance with [Assignment: organization- defined monitoring objectives]; and 2. Unauthorized local, network, and remote connections; b. Identifies unauthorized use of the information system through [Assignment: organization- defined techniques and methods]; c. Deploys monitoring devices: i. strategically within the information system to collect organization-determined essential information; and (ii) at ad hoc locations within the system to track specific types of transactions of interest to the organization.11

Attributes

Item Id: si-4-a-b-c
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Information System Monitoring (SI-4)

si-7-1The information system performs an integrity check of security relevant events at least monthly.3

Attributes

Item Id: si-7-1
Section: System and Information Integrity (SI)
Service: aws
Sub Section: Software, Firmware, and Information Integrity (SI-7)

si-7The organization employs integrity verification tools to detect unauthorized changes to [Assignment: organization-defined software, firmware, and information].2

Attributes

Item Id: si-7
Section: System and Information Integrity (SI)
Service: aws

si-12The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.6

Attributes

Item Id: si-12
Section: System and Information Integrity (SI)
Service: aws